(1)

As noted in recital 4 of Recommendation ESRB/2013/1 of the European Systemic Risk Board (4), the ultimate objective of macroprudential policy is to contribute to safeguarding the stability of the financial system as a whole, including by strengthening the resilience of the financial system and decreasing the build-up of systemic risks, thereby ensuring a sustainable contribution of the financial sector to economic growth. The European Systemic Risk Board (ESRB) is responsible for the macroprudential oversight of the financial system within the Union. In fulfilling its mandate, the ESRB should contribute to the prevention and mitigation of systemic risks to financial stability, including those related to cyber incidents, and propose how these risks might be mitigated.

(2)

Major cyber incidents may pose a systemic risk to the financial system given their potential to disrupt critical financial services and operations. The amplification of an initial shock can either occur through operational or financial contagion or through an erosion of confidence in the financial system. If the financial system is unable to absorb these shocks, financial stability will be at risk and this situation can result in a systemic cyber crisis (5).

(3)

The constantly evolving cyber threat landscape and recent increase of major cyber incidents are indicators of greater risk to financial stability in the Union. The COVID-19 pandemic has highlighted the importance of the role technology plays in allowing the financial system to operate. Relevant authorities and institutions needed to adapt their technical infrastructure and risk management frameworks to a sudden increase in remote working, which has increased the overall exposure of the financial system to cyber threats and allowed criminals both to devise new modi operandi and to adapt existing ones to exploit the situation (6). Against this background, the number of cyber incidents reported to ECB Banking Supervision in 2020 increased by 54 % compared with 2019 (7).

(4)

A major cyber incident’s potentially large scale, speed and rate of propagation call for an effective response from the relevant authorities to mitigate the potential negative effects on financial stability. Swift coordination and communication among relevant authorities at Union level can assist in early assessment of a major cyber incident’s impact on financial stability, maintaining confidence in the financial system and limiting contagion to other financial institutions and thus contribute to preventing a major cyber incident from becoming a risk to financial stability.

(5)

The underlying shock originates in a novel way compared to the traditional financial and liquidity crises relevant authorities usually face. Aside from financial aspects, the overall risk assessment must include the scale and impact of operational disruptions as these might influence the choice of macroprudential tools. Likewise, financial stability might also influence the choice of operational mitigants by cyber experts. This calls for close and swift coordination and open communication to, inter alia, build situational awareness.

(6)

The risk of a coordination failure by authorities exists and needs to be addressed. Relevant authorities in the Union will need to coordinate among themselves and with other authorities such as the European Union Agency for Network and Information Security (ENISA) with which they might not usually interact. As a significant number of Union financial institutions operate globally, a major cyber incident will likely not be limited to the Union or might be triggered outside the Union and might require global response coordination.

(7)

The relevant authorities need to be prepared for these interactions. Otherwise, they might risk taking inconsistent actions that contradict or jeopardise other authorities’ responses. Such a coordination failure could amplify the shock for the financial system by leading to an erosion of confidence in the functioning of the financial system which, in the worst-case scenario, would pose a risk to financial stability (8).Thus, the necessary steps should be taken to address the risk to financial stability stemming from a coordination failure in the event of a major cyber incident.

(8)

The ESRB (2021) report Mitigating systemic cyber risk (9) identifies the need to establish a pan-European systemic cyber incident coordination framework (EU-SCICF) for relevant authorities in the Union. The objective of the EU-SCICF would be to increase relevant authorities’ level of preparedness to facilitate a coordinated response to a potentially major cyber incident. The ESRB (2021) report Mitigating systemic cyber risk provides the ESRB’s assessment on the framework characteristics that would be needed, prima facie, in order to address the risk of a coordination failure.

(9)

The key objective of this Recommendation is to build on one of the envisaged roles of the European Supervisory Authorities (ESAs) under the proposal for a Regulation of the European Parliament and of the Council on digital operational resilience for the financial sector (10) (hereinafter ‘DORA’) of gradually enabling an effective Union-level coordinated response in the event of a major cross-border information and communication technologies (ICT) related incident or related threat having a systemic impact on the Union’s financial sector as a whole. This process will lead to the creation of the EU-SCICF for relevant authorities.

(10)

The EU-SCICF should not aim to replace existing frameworks but to bridge any coordination and communication gaps between the relevant authorities themselves and with other authorities in the Union and other key actors at international level. In this respect, the positioning of the EU-SCICF in the existing financial crisis framework and Union cyber incident framework landscape should be considered. Regarding coordination among the relevant authorities themselves, consideration should be given, but not be limited to, the roles and activities of the Network and Information Systems (NIS) Cooperation Group for financial entities under Directive (EU) 2016/1148 of the European Parliament and of the Council (11), and the coordination mechanisms envisaged through the establishment of the Joint Cyber Unit alongside the involvement of ENISA.

(11)

In particular, the proposal to launch the preparation of the EU-SCICF aims to endorse the potential roles of the ESAs, as envisaged by the DORA proposal. DORA proposes that ‘the ESAs, through the Joint Committee and in collaboration with competent authorities, the European Central Bank (ECB) and the ESRB, may establish mechanisms to enable the sharing of effective practices across financial sectors to enhance situational awareness and identify common cyber vulnerabilities and risks across-sectors’ and ‘may develop crisis-management and contingency exercises involving cyberattack scenarios with a view to develop communication channels and gradually enable an effective EU-level coordinated response in the event of a major cross-border ICT-related incident or related threat having a systemic impact on the Union’s financial sector as a whole’ (12). A pan-European framework such as the EU-SCICF does not yet exist and should be established and developed in the context of DORA.

(12)

Given the risk to financial stability in the Union stemming from cyber risk, preparatory work for the gradual establishment of the EU-SCICF should, to the extent feasible, start even before the required legal and policy framework for its establishment is fully applicable. This legal and policy framework would be completed fully and finalised once the relevant provisions of DORA and of its delegated acts become applicable.

(13)

Effective communication contributes to situational awareness among relevant authorities and is thus an indispensable prerequisite for Union-wide coordination during major cyber incidents. In this respect, the communication infrastructure needed to coordinate on a response to a major cyber incident should be defined. This would imply specifying the type of information that needs to be shared, the regular channels to be used to share such information and the contact points with which information should be shared. Information sharing must respect existing legal requirements. In addition, a clear action plan and the protocols to be followed may need to be defined by the relevant authorities to ensure proper coordination among the authorities involved in planning a coordinated response to a major cyber incident.

(14)

A systemic cyber crisis will require the setting in motion of full cooperation at national and Union level. Therefore, the designation of points of contact for the ESAs, the ECB and each Member State from among its relevant national authorities, which should be communicated to the ESAs, may be envisaged to establish the main interlocutors in the coordination scheme of the EU-SCICF to be informed in case of a major cyber incident. The need to designate points of contact should be assessed during the development of the EU-SCICF, taking into account the designated single point of contact under Directive (EU) 2016/1148 that Member States have established on the security of network and information systems to ensure cross-border cooperation with other Member States and with the NIS Cooperation Group (13).

(15)

The conduct of crisis management and contingency exercises could facilitate the implementation of the EU-SCICF and allow authorities to evaluate their readiness and preparedness for a systemic cyber crisis at Union level. Such exercises would provide authorities with lessons learnt and would enable continuous improvement and evolution of the EU-SCICF.

(16)

For the development of the EU-SCICF it is essential that the ESAs jointly carry out relevant preparatory work to consider the potential key elements of the framework and the required resources and needs to proceed with its development. After this, the ESAs could start work on a preliminary analysis of any impediments that could hinder the ESAs and relevant authorities’ abilities to establish the EU-SCICF and to share relevant information through communication channels in case of a major cyber incident. Such analysis would be an important step informing any further action, either of legislative nature or other supporting initiatives that the European Commission may take in the post-DORA implementation stage,

1.

2.

(a)

‘cyber’ means relating to, within, or through the medium of the interconnected information infrastructure of interactions among persons, processes, data, and information systems (14);

(b)

‘major cyber incident’ means an ICT-related incident with a potentially high adverse impact on the network and information systems that support critical functions of financial entities (15);

(c)

‘systemic cyber crisis’ means a major cyber incident that causes a level of disruption in the Union financial system potentially entailing serious negative consequences for the smooth operation of the internal market and the functioning of the real economy. Such a crisis could result from a major cyber incident causing shocks in a number of channels, including operational, confidence and financial;

(d)

‘European Supervisory Authorities’ or the ‘ESAs’ means the European Supervisory Authority (European Banking Authority) established by Regulation (EU) No 1093/2010 of the European Parliament and of the Council (16), together with the European Supervisory Authority (European Insurance and Occupational Pensions Authority) established by Regulation (EU) No 1094/2010 of the European Parliament and of the Council (17) and the European Supervisory Authority (European Securities and Markets Authority) established by Regulation (EU) No 1095/2010 of the European Parliament and of the Council (18);

(e)

‘Joint Committee’ means the Joint Committee of the European Supervisory Authorities established in Article 54 of Regulation (EU) No 1093/2010, of Regulation (EU) No 1094/2010 and of Regulation (EU) No 1095/2010;

(f)

‘relevant national authority’ means:

(g)

‘relevant authority’ means:

(a)

due regard should be paid to the need-to-know principle and the principle of proportionality, taking into account the objective and the content of each Recommendation;

(b)

the specific compliance criteria set out in the Annex in relation to each Recommendation should be met.

1.

Recommendation A

2.

Recommendation B

By 30 June 2023 but no earlier than six months after DORA enters into force, the ESAs, the ECB and Member States are requested to deliver to the European Parliament, the Council, the Commission and to the ESRB a report on the implementation of Recommendation B.

3.

Recommendation C

1.

The ESRB Secretariat will:

2.

The General Board will assess the actions and justifications communicated by the addressees and, where appropriate, may decide that this Recommendation has not been followed and that an addressee has failed to provide adequate justification for its inaction.